CVE-2026-63294Ejecución de comandos como root en el host en LXD
A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpacking of crafted image or backup archives, LXD fails to properly validate and confine the backup.yaml file when it exists as a symbolic link. An attacker can exploit this flaw by providing a malicious archive with a symlinked backup.yaml file, causing LXD to process unconfined configuration metadata and execute arbitrary commands with root privileges.
Ver en NVDAnálisis
A critical vulnerability in LXD allows an attacker to escape a container and execute commands as root on the host system. The flaw is triggered when importing a malicious image or backup archive containing a crafted symbolic link.
Roles relevantes
Severidad
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HCWE-59EPSS
Sin puntaje EPSS aún (CVE muy reciente).
Descripción técnica
A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpacking of crafted image or backup archives, LXD fails to properly validate and confine the backup.yaml file when it exists as a symbolic link. An attacker can exploit this flaw by providing a malicious archive with a symlinked backup.yaml file, causing LXD to process unconfined configuration metadata and execute arbitrary commands with root privileges.